Mar 22 04 04:53p 



SVI1 



4Q8 971 46G0 



p. 1 1 



-6- 



. ' REMARKS 



The Examiner has again rejected Claims 1-4, 6-8, 10-17, and 20-22 under 35 
U.S.C. 102(e) as being anticipated by Conklin et al. (USPN 5,991 ,881). Applicant 
respectfully disagrees with this assertion. 



Specifically, in his latest action, the Examiner argues that applicant misinterprets 
the terminologies when comparing the limitations of the independent claims with 
applicant's quoted paragraph from Conklin. Moreover, the Examiner now relies on the 
abstract and col. 6, lines 40-43 from Conklin to meet applicant's claimed "discarding at 
least a portion of the accounting information that occurs during a surge in network traffic, 
based on the monitored aspect." Following are such excerpts. 



"This is a system and method for network surveillance and 
detection of attempted intrusions, or intrusions, into the network 
- - - - and- into computers connected to the network. The System functions 
are: (A) intrusion detection monitoring, (B) real-time alert, (C) 
logging of potential unauthorized activity, and (D) incident 
progress analysis and reporting. Upon detection of any attempts to 
intrude, the System will initiate a log of all activity between 
the computer elements involved and send an alert to a monitoring 
console. When a log is initiated, the network continues to be 
monitored by a primary surveillance system. A secondary monitoring 
process is started which interrogates the activity log in real- 
time and sends additional alerts reporting the progress of the 
suspected intruder." (Abstract) 

"Third party evidence logging provides reliable data for 
determining appropriate response activities, such as restoring 
lost data, removing unauthorized programs, or disconnecting the 
system from the network temporarily. " (col. 6, lines 40-43) 

The Examiner summarizes applicant's arguments as being merely based on the 
"discarded" limitation. Applicant respectfully disagrees, as applicant teaches and claims 
"discarding at least a portion of the accounting information that occurs during a surge in 
network traffic, based on the monitored aspect/' not just "discarding/' as specifically 
claimed. 
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It appears that the Examiner is relying on Conklin's "disconnecting the system 
from the network temporarily" language to meet applicant's claimed "discarding." 

Applicant asserts, however, that such excerpts from Conklin are merely 
suggesting disconnecting network traffic, and not discarding "network accounting 
information" (emphasis added). 

In use, network accounting information processors collect network accounting 
information relating to network traffic. In case of a surge in network traffic, such 
accounting information associated with the network traffic may become overly 
cumbersome for processor resources (i.e. memory, etc.). 

Thus, only applicant teaches and claims a technique of dealing with "network 
accounting information," specifically, to prevent overflow of this particular type of 
information, during a surge in network traffic. It is noted that Conklin would prevent 
- -overall communication of network traffic via the network by virtue of its "disconnecting" 
while applicant's claimed invention may optionally allow such communication, while 
still avoiding "network accounting information" overflow. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros. v. Union Oil Co. Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
Ca868 F.2d 1226, 1236, 9USPQ2d 191 3, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required bv the claim . This criterion has simply not been met by the Conklin 
reference, at least in part, because it does not disclose discarding "network accounting 
information" based on a monitored aspect during a surge in network traffic. 
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It is further noted that the Examiner's application of the prior art to the remaining 
claims is replete with deficiencies. Just by way of example, with respect to Claim 23, the 
Examiner relies on Conklin's teaching that "network specific characteristics or facts may 
be developed from the network data collection over time and stored in a database" to 
meet applicant's claimed "detecting a rate of receipt of the accounting information [and] 
detecting whether the rate of receipt of the accounting information exceeds a 
predetermined amount." 

However, the mere discussion of network specific characteristics "over time" does 
not rise to the level of specificity to meet applicant's claimed predetermined rate 
threshold-based discarding of accounting information. Moreover, it is noted that the 
Examiner simply looks to Trcka and Savoldi to meet applicant's claimed port scans and 
load detection. However, the proposed combination still fails to meet applicant's specific 
accounting information overload prevention technique involving the discarding of the 
same based on port scans and network load detection. 

For these reasons, each of the independent claims are deemed allowable, along 
with any claims depending therefrom. 

If the Examiner continues to disagree with applicant's arguments, applicant 
respectfully requests that an interview be scheduled to discuss the foregoing paramount 
distinctions, and possibly some additional claim language to emphasize the same. 

Simply nowhere in the prior art is there such a combination of features for 
fulfilling the foregoing objectives. 

A notice of allowance is respectfully requested. 
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In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5 1 00. The 
Commissioner is hereby authorized to charge any fees that may be due or credit any 
overpayment to Deposit Account No. 50-1351 (Order No. XACTP001). 



P.O.Box 721120 

San Jose, CA 95172-1120 

408-505-5100 




429 
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